CVE-2019-25452: Dolibarr ERP/CRM SQLi Vulnerability

CVE-2019-25452 Overview

CVE-2019-25452 is a SQL Injection vulnerability affecting Dolibarr ERP/CRM version 10.0.1. The vulnerability exists in the elemid POST parameter of the viewcat.php endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries against the underlying database. This flaw enables malicious actors to extract sensitive business data, user credentials, and other confidential information stored within the ERP/CRM system without requiring any authentication.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive database information including customer records, financial data, and user credentials from Dolibarr ERP/CRM installations.

Affected Products

• Dolibarr ERP/CRM version 10.0.1

Discovery Timeline

• 2026-02-22 - CVE-2019-25452 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2019-25452

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from improper input validation in the Dolibarr ERP/CRM web application. The viewcat.php endpoint fails to properly sanitize user-supplied input in the elemid POST parameter before incorporating it into SQL queries. This allows attackers to inject malicious SQL statements that are executed by the database server with the privileges of the application's database user.

The vulnerability is particularly severe because it does not require authentication, meaning any network-accessible Dolibarr installation is at risk. Attackers can leverage both error-based and time-based blind SQL injection techniques to systematically enumerate database contents, extract sensitive information, or potentially modify data depending on database permissions.

Root Cause

The root cause of CVE-2019-25452 is the lack of proper input sanitization and parameterized queries in the viewcat.php endpoint. User-supplied data from the elemid POST parameter is directly concatenated into SQL query strings without adequate escaping or use of prepared statements. This classic SQL injection pattern allows attackers to break out of the intended query context and inject arbitrary SQL commands.

Attack Vector

The attack is conducted over the network by sending specially crafted HTTP POST requests to the vulnerable viewcat.php endpoint. Attackers construct malicious SQL payloads within the elemid parameter that manipulate the query logic. Error-based injection returns database information through error messages, while time-based blind injection uses conditional delays to infer data one character at a time. No authentication is required, making this vulnerability exploitable by any attacker with network access to the Dolibarr installation.

Technical details and exploitation information can be found in the Exploit-DB #47362 entry and the VulnCheck Advisory.

Detection Methods for CVE-2019-25452

Indicators of Compromise

• Unusual POST requests to /viewcat.php containing SQL syntax characters such as single quotes, UNION statements, or comment markers in the elemid parameter
• Database error messages appearing in HTTP responses that reveal table names, column names, or query structure
• Abnormal database query patterns including time delays consistent with blind SQL injection attempts
• Unexpected database read operations or data exfiltration from the Dolibarr database

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in POST parameters
• Enable and monitor database query logging for suspicious SQL statements containing UNION SELECT, SLEEP(), or BENCHMARK() functions
• Configure intrusion detection systems (IDS) to alert on HTTP requests containing common SQL injection signatures
• Review Dolibarr web server access logs for repeated requests to viewcat.php with varying elemid parameter values

Monitoring Recommendations

• Monitor database performance metrics for unexpected increases in query execution time that may indicate time-based blind SQL injection
• Set up alerts for database authentication failures or permission denied errors that may indicate attempted privilege escalation
• Implement application-level logging to capture all requests to sensitive endpoints including viewcat.php

How to Mitigate CVE-2019-25452

Immediate Actions Required

• Upgrade Dolibarr ERP/CRM to a patched version that addresses this SQL injection vulnerability
• Restrict network access to the Dolibarr installation using firewall rules to limit exposure
• Deploy a web application firewall (WAF) with SQL injection detection rules in front of the Dolibarr application
• Review database audit logs for any evidence of prior exploitation attempts

Patch Information

Organizations running Dolibarr ERP/CRM version 10.0.1 should upgrade to a newer version that addresses this vulnerability. Consult the VulnCheck Advisory for additional guidance on remediation steps.

Workarounds

• Implement network-level access controls to restrict access to the Dolibarr installation to trusted IP addresses only
• Deploy a reverse proxy or WAF configured with strict SQL injection filtering rules for all POST parameters
• Disable or restrict access to the viewcat.php endpoint if the category viewing functionality is not required
• Consider implementing database user permissions with minimal privileges to limit the impact of successful SQL injection

# Example WAF rule for ModSecurity to block SQL injection attempts
SecRule ARGS:elemid "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in elemid parameter',\
    log,\
    auditlog"